Fine-grained Protection Domain based on Segmentation Mechanism

Extensibility is a vital property of modern applications. An extension component is downloaded from Internet and loaded into an application. However, an extension component may be malicious. Thus there is a risk of the application being illegally accessed. To protect the application from malicious components, this paper proposes a multi-protection page table: a mechanism for providing protection among an application and components residing in the same address space. A multi-protection page table provides kernel-level fine-grained protection domains, thereby enabling efficient crossdomain calls between fine-grained protection domains. To prove that a multi-protection page table can be implemented on stock hardware, the paper shows the implementation on IA-32 (32-bit Intel Architectures). Experimental results show that a cross-domain call requires only 267-700 cycles and the performance in a real application is also good enough.